4 ms·

Secure Boot only verifies the NT kernel loader; that in turn will verify that the kernel is signed by Microsoft, and then the kernel will verify any device driv

Secure Boot only verifies the NT kernel loader; that in turn will verify that the kernel is signed by Microsoft, and then the kernel will verify any device drivers it loads. Userland (e.g. explorer.exe) is free to be run without any signatures whatsoever; this includes the login screen.

sim7c00 3y ago
its a shame they need to lean on defender for this. it wouldnt be too long of a stretch to expect windows to verify the binaries it ships with, and not accept unsigned ones for those windows / MS binaries in the windows directory :(. it does no justice to all the good that could be done via secure boot
- mr_mitm 3y ago
  We don't expect Linux to do this, do we? Just use full disk encryption, preferably with pre-boot authentication. TPM if you must, but this will only make the attack somewhat more expensive. Other than that, the hardware is compromised as soon as somebody gets their hands on it. Checking the integrity of a few binaries is mostly security theater. Besides manipulating executables, the adversary could simply modify or read the user database in C:\Windows\System32\config\SAM. [1] Alternatively, patch routines directly in memory [2] [1] https://www.kali.org/tools/chntpw/ https://www.kali.org/tools/chntpw/ [2] https://www.piotrbania.com/all/kon-boot/ https://www.piotrbania.com/all/kon-boot/
  - the8472 3y ago
    > We don't expect Linux to do this, do we? Linux can be setup to verify an immutable userland via secure boot + dm-verity. I think it's used in some google devices (chromebooks?).
    - wazzaps 3y ago
      All androids do it as well
      - chromoblob 3y ago
        No, only Android from version 4.4 supports Verified Boot, and only Android from version 7.0 strictly enforces it.
pjmlp 3y ago
Still possible, as presented at BlueHat IL 2023, the goal is to eventually have everything signed, based on how UWP sandboxing is working, now extended to Win32 as well. First set of changes already in flight for the next Windows 11 stable release.

sim7c00 3y ago

its a shame they need to lean on defender for this. it wouldnt be too long of a stretch to expect windows to verify the binaries it ships with, and not accept unsigned ones for those windows / MS binaries in the windows directory :(. it does no justice to all the good that could be done via secure boot

mr_mitm 3y ago
We don't expect Linux to do this, do we? Just use full disk encryption, preferably with pre-boot authentication. TPM if you must, but this will only make the attack somewhat more expensive. Other than that, the hardware is compromised as soon as somebody gets their hands on it. Checking the integrity of a few binaries is mostly security theater. Besides manipulating executables, the adversary could simply modify or read the user database in C:\Windows\System32\config\SAM. [1] Alternatively, patch routines directly in memory [2] [1] https://www.kali.org/tools/chntpw/ https://www.kali.org/tools/chntpw/ [2] https://www.piotrbania.com/all/kon-boot/ https://www.piotrbania.com/all/kon-boot/
- the8472 3y ago
  > We don't expect Linux to do this, do we? Linux can be setup to verify an immutable userland via secure boot + dm-verity. I think it's used in some google devices (chromebooks?).
  - wazzaps 3y ago
    All androids do it as well
    - chromoblob 3y ago
      No, only Android from version 4.4 supports Verified Boot, and only Android from version 7.0 strictly enforces it.

pjmlp 3y ago

Still possible, as presented at BlueHat IL 2023, the goal is to eventually have everything signed, based on how UWP sandboxing is working, now extended to Win32 as well. First set of changes already in flight for the next Windows 11 stable release.